CVE-2026-8766 | Kilo-Org kilocode up to 7.0.47 Environment Variable config.ts load KILO_CONFIG_CONTENT information disclosure

A vulnerability described as problematic has been identified in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the component Environment Variable Handler. Executing a manipulation of the argument KILO_CONFIG_CONTENT can lead to information disclosure.

This vulnerability is registered as CVE-2026-8766. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.